JP2020010186A - Information processing device and information processing program - Google Patents

Abstract

To provide an information processing device that can reduce a load on the information processing device as compared with a case of adopting a strong authentication function at each time of communication when the information processing device communicates with a legitimate communication apparatus.SOLUTION: In an information processing device, reception means receives information from a communication apparatus, determination means determines a continuity evaluation value indicating that the communication apparatus is continuously communicating by using a communication plan set to the communication apparatus and identification information capable of identifying a communication source of the communication apparatus, and determination means determines whether the communication apparatus is a legitimate communication apparatus depending on whether the continuity evaluation value satisfies a predetermined rule.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing device and an information processing program.

  Patent Document 1 has an object to provide an authentication server, an authentication method, and an authentication program capable of preventing an unauthorized connection of a device to a network, and to provide performance information indicating communication behavior of a plurality of devices accommodated in a gateway. An acquisition unit that acquires the performance information from the gateway, a device information storage unit that stores the performance information, and generates model data indicating a normal behavior of the device based on the performance information stored in the device information storage unit. Generating unit, a determination model storage unit that stores the model data, and the performance information newly obtained by the obtaining unit is compared with the model data to determine a risk level of a device corresponding to the performance information. A determination unit, and the risk determined by the determination unit Depending on the bell, it is provided with a management unit that manages the connection to the external network from the gateway by the device is disclosed.

Japanese Patent No. 6066677

According to a communication plan, communication with a communication device is performed a plurality of times. For example, since there is an impersonation attack or the like from an unauthorized communication device whose identification information is duplicated, it is determined whether or not the communication device is an authorized communication device using an authentication function. On the other hand, in the case of performing communication with a plurality of communication devices, as represented by the IoT, if a strong authentication function is employed for each communication, the load on the information processing apparatus that performs communication with the communication device also increases. .
The present invention provides an information processing apparatus capable of reducing the load on an information processing apparatus when performing communication with a legitimate communication device, as compared with a case where a strong authentication function is employed for each communication. The purpose is to provide an information processing program.

The gist of the present invention to achieve this object lies in the inventions in the following items.
The invention according to claim 1 uses a receiving unit that receives information from a communication device, a communication plan set for the communication device, and identification information that can identify a communication source of the communication device. Determining means for determining a continuity evaluation value indicating that communication is being performed, and whether or not the continuity evaluation value satisfies a predetermined rule, whereby the communication device is a legitimate communication device. This is an information processing apparatus having a determination unit for determining whether or not the information processing is performed.

  The invention according to claim 2 is the information processing apparatus according to claim 1, wherein the determination unit sets a continuity evaluation value to an initial value when the communication plan set in the communication device is not followed.

  The invention according to claim 3 is characterized in that the deciding means follows a communication plan set in the communication device, and when the specific information is the same as the previous time and the current time, the continuity evaluation value of the current time in the communication device is set to the previous continuous time. 2. The information processing apparatus according to claim 1, wherein the value is set to a value increased from a gender evaluation value.

  The invention according to claim 4 uses a plurality of pieces of specific information, and when the specific information is the same in the previous time and the current time, the continuity evaluation value of the communication device in this communication device is compared with the continuity evaluation value of the previous time for each of the specific information. 4. The information processing apparatus according to claim 3, wherein the value is also increased.

  The invention according to claim 5 is the information processing apparatus according to claim 1, wherein the determination unit determines that the communication device is a legitimate communication device when the communication device follows a communication plan set in the communication device. is there.

  The invention according to claim 6 is characterized in that, when the current continuity evaluation value is in a predetermined order within the continuity evaluation value from the time of the previous reception in the communication plan, the communication device is determined. The information processing device according to claim 5, wherein the information processing device determines that the communication device is a legitimate communication device.

  7. The communication device according to claim 7, wherein the communication device is configured to use a receiving unit that receives information from the communication device, a communication plan set for the communication device, and identification information that can identify a communication source of the communication device. Determining means for determining a continuity evaluation value indicating that continuous communication is being performed from; and determining whether the continuity evaluation value satisfies a predetermined rule. This is an information processing program for functioning as a determination unit that determines whether the device is a device.

  According to the information processing apparatus of the first aspect, when the information processing apparatus communicates with a legitimate communication device, the load on the information processing apparatus is reduced as compared with a case where a strong authentication function is employed for each communication. be able to.

  According to the information processing apparatus of the second aspect, the continuity evaluation value can be set to the initial value when the communication plan set in the communication device is not followed.

  According to the information processing apparatus according to the third aspect, the continuity evaluation value can be increased when the specific information is the same as the previous time and the current time according to the communication plan set for the communication device.

  According to the information processing apparatus of the fourth aspect, when the plurality of specific information is the same in the previous and current times, the continuity evaluation value can be increased for each of the specific information.

  According to the information processing apparatus of claim 5, it is possible to use the fact that the communication device is in accordance with the communication plan set for the communication device to determine that the communication device is a legitimate communication device.

  According to the information processing apparatus of the sixth aspect, the continuity evaluation value of this time is predetermined in the continuity evaluation value from the previous reception in the communication plan to determine that the communication device is a legitimate communication device. The ranking can be used.

  According to the information processing program of the present invention, when the information processing device communicates with a legitimate communication device, the load on the information processing device is reduced as compared with a case where a strong authentication function is employed for each communication. be able to.

FIG. 2 is a conceptual module configuration diagram illustrating a configuration example according to the present embodiment. FIG. 2 is an explanatory diagram illustrating a system configuration example using the present embodiment. 5 is a flowchart illustrating a processing example according to the exemplary embodiment; It is an explanatory view showing an example of a data structure of a communication plan table. 5 is a flowchart illustrating a processing example according to the exemplary embodiment; It is an explanatory view showing an example of a data structure of a communication plan table. 5 is a flowchart illustrating a processing example according to the exemplary embodiment; FIG. 9 is an explanatory diagram illustrating an example of a data structure of a communication log information table. FIG. 9 is an explanatory diagram illustrating an example of a data structure of a communication log information table. FIG. 9 is an explanatory diagram illustrating an example of a data structure of a communication log information table. 5 is a flowchart illustrating a processing example according to the exemplary embodiment; 5 is a flowchart illustrating a processing example according to the exemplary embodiment; FIG. 9 is an explanatory diagram illustrating an example of a data structure of a communication log information table. FIG. 9 is an explanatory diagram illustrating an example of a data structure of a communication log information table. FIG. 9 is an explanatory diagram illustrating an example of a data structure of a communication log information table. FIG. 9 is an explanatory diagram illustrating an example of transition of a continuity evaluation value according to the present embodiment. FIG. 11 is an explanatory diagram showing another example of a system configuration using the present embodiment. FIG. 2 is a block diagram illustrating an example of a hardware configuration of a computer that implements the exemplary embodiment.

First, prior to the description of the present embodiment, a premise technology will be described. This description is intended to facilitate understanding of the present embodiment.
2. Description of the Related Art Various methods for authenticating an authorized device have been disclosed in communication between a device (communication device) and a server representing the Internet of Things (hereinafter, IoT) and a server.
For example, when using the common key method, authentication is performed using a common key distributed in advance to the device and the server. When using a public key scheme represented by PKI (Public Key Infrastructure), a certificate is distributed to a device in advance, and a server authenticates a legitimate device by verifying the certificate of the device.
However, in any case, when a device is reverse-engineered (including a physical method such as copying a hard disk) and confidential information and device identification information are obtained, it is difficult to identify a spoofing attack that abuses such information.

Also, PKI is the main method of device authentication, but not only human costs such as the establishment of a certificate authority and the operation of certificates, but also the communication load (bandwidth) between devices and servers involved in certificate exchange, and their signature values. Also, the CPU load of the server and the device related to the verification must be considered. Especially in the field of IoT, the server needs to handle hundreds of thousands of devices, and the device often has limited computer resources. In a system for sensing, the device constantly sends sensor information to the server. There is a need to. As described above, when a large amount of communication is performed by a large number of devices, it may be difficult to adopt the PKI. When PKI is adopted, a server requires a large amount of computer resources. For example, in the case of a pay-as-you-go system such as a cloud, a high bill is required.
Note that it is assumed that the device authenticates each time sensor information is transmitted.However, if a method of continuing a session after one authentication is adopted, scalability is impaired due to the limitation of the maximum number of sessions of the server or the load balancer in the preceding stage. Therefore, in the present embodiment, stateless communication (without UDP or TCP keepalive) is premised. Note that communication with a state means that continuity is guaranteed in the first place. Therefore, it is necessary to manage the state (communication state) on the server side. Stateless communication has no relation between the previous communication and the current communication, and does not require state management on the server side.

Hereinafter, an example of a preferred embodiment for realizing the present invention will be described with reference to the drawings.
FIG. 1 is a conceptual module configuration diagram of a configuration example according to the present embodiment.
Note that a module generally refers to a component such as software (computer program) and hardware that can be logically separated. Therefore, the module in the present embodiment indicates not only a module in a computer program but also a module in a hardware configuration. Therefore, the present embodiment is directed to a computer program for causing these modules to function as a program (a program for causing a computer to execute each procedure, a program for causing a computer to function as each means, ), And a description of a system and a method. However, for the sake of explanation, “store”, “store”, and equivalent words are used. However, when the embodiment is a computer program, these words are stored in a storage device or stored. This means that control is performed so as to be stored in the device. Further, the modules may correspond to the functions on a one-to-one basis, but in implementation, one module may be configured with one program, a plurality of modules may be configured with one program, and conversely, one module may be configured. May be composed of a plurality of programs. Also, a plurality of modules may be executed by one computer, or one module may be executed by a plurality of computers in a distributed or parallel environment. Note that one module may include another module. Hereinafter, the term “connection” is used not only for a physical connection but also for a logical connection (data transmission / reception, instruction, reference relationship between data, login, etc.). "Predetermined" means that the process is determined before the process of interest, not only before the process according to the present embodiment starts, but also after the process according to the present embodiment starts. If it is before the target processing, it is used in accordance with the situation / state at that time or with the intention of being determined according to the situation / state up to that time. When there are a plurality of "predetermined values", the values may be different from each other, or two or more values (including all values, of course) may be the same. In addition, the expression “if it is A, do B” is used to mean “determine whether or not it is A, and if it is A, do B”. However, this does not apply to cases where it is not necessary to determine whether or not it is A. Further, when an object is enumerated such as “A, B, C” or the like, the enumeration is an example unless otherwise specified, and includes a case where only one of them is selected (for example, only A).
In addition, a system or an apparatus is configured by connecting a plurality of computers, hardware, apparatuses, and the like by communication means such as a network (including one-to-one correspondence communication connection), and one computer, hardware, and apparatus. Etc. are also included. “Apparatus” and “system” are used as synonymous terms. Of course, the “system” does not include anything that is merely a social “mechanism” (social system) that is an artificial arrangement.
In addition, for each process performed by each module or when a plurality of processes are performed in a module, target information is read from the storage device, and after performing the process, the processing result is written to the storage device. is there. Therefore, description of reading from the storage device before processing and writing to the storage device after processing may be omitted. Note that the storage device here may include a hard disk, a RAM (Random Access Memory), an external storage medium, a storage device via a communication line, a register in a CPU (Central Processing Unit), and the like.

  The information processing system according to the present embodiment manages communication between the information processing device 100 and the communication device 150. As shown in the example of FIG. 1, the information processing device 100 and the communication device 150 190 are connected. In the example of FIG. 1, one communication device 150 communicates with one information processing device 100, but a plurality of communication devices 150 communicate with one information processing device 100. You may. Generally, communication with a plurality of communication devices 150 is performed. An information processing system is configured by the communication device 150 (generally, a plurality of communication devices 150) and the information processing device 100. The communication line 190 may be wireless, wired, or a combination thereof, for example, wireless communication such as Wi-Fi and Bluetooth (registered trademark, Bluetooth (registered trademark)), the Internet as an communication infrastructure, an intranet, and the like. You may.

  For example, the communication device 150 is a device that makes a direct communication connection with the information processing apparatus 100. The communication device 150 is used when the communication with the information processing device 100 is planned (generally, constantly). The information processing apparatus 100 performs communication based on a communication plan (communication interval, communication method, etc.) presented to the communication apparatus 150 by the information processing apparatus 100 and communication information (srcIP, srcPort, TTL, etc.) from the communication apparatus 150 thereafter. A communication that evaluates communication continuity with the device 150 (determines a continuity evaluation value), manages the continuity evaluation value in association with (identifies) the identification information of the communication device 150, and communicates by giving the same communication device 150. , The access control is exclusively performed by regarding the lower continuity evaluation value as an unauthorized device. Thereby, it is possible to protect the information processing apparatus 100 from impersonation attack by an unauthorized device without imposing a load. Even if secret information or the like is illegally copied from the communication device 150 and misused, it is difficult to deceive the continuity of communication of the legitimate communication device 150. For example, as described above, when a copy of the hard disk is made and the device is reverse-engineered, the continuity evaluation value becomes low because the power is turned off.

The information processing apparatus 100 includes a transmission / reception module 102, a sensor information storage module 104, and an audit module 110. The information processing apparatus 100 has a role as a server for the communication device 150, receives data (for example, sensor information) from the communication device 150, stores the data in the sensor information storage module 104, and It performs information processing or transmits the data to another information processing apparatus.
The transmission / reception module 102 is connected to the sensor information storage module 104, the communication plan presentation module 112 of the audit module 110, the communication source continuity evaluation module 116, and the unauthorized communication device determination module 120, and communicates via the communication line 190. The transmission / reception module 152 of the device 150 is connected. The transmission / reception module 102 performs communication with the communication device 150. For example, a communication plan is transmitted to the communication device 150, and information (specific information that can specify a communication source in addition to sensor information and the like) is received from the communication device 150.
The sensor information storage module 104 is connected to the transmission / reception module 102, the communication plan presentation module 112 of the audit module 110, the communication source continuity evaluation module 116, and the unauthorized communication device determination module 120. The sensor information storage module 104 stores information received by the transmission / reception module 102.

The audit module 110 includes a communication plan presentation module 112, a communication plan storage module 114, a communication source continuity evaluation module 116, an evaluation value storage module 118, an unauthorized communication device determination module 120, and an access control module 122. The audit module 110 determines whether the communication device 150 that has communicated is a legitimate communication device 150. Here, the authorized communication device 150 is a communication device 150 that originally communicates with the information processing apparatus 100. The term “illegal” refers to, for example, impersonation of a source IP address.
The communication plan presentation module 112 is connected to the transmission / reception module 102, the sensor information storage module 104, and the communication plan storage module 114. The communication plan presentation module 112 transmits the communication plan stored in the communication plan storage module 114 to the communication device 150 via the transmission / reception module 102. For example, in the first communication with the communication device 150, a communication plan is transmitted. The communication plan may be customized for each communication device 150, or one communication plan may be applied to a plurality of communication devices 150.
The communication plan storage module 114 is connected to the communication plan presentation module 112 and the communication source continuity evaluation module 116. The communication plan storage module 114 stores a communication plan. For example, a communication plan table 600 described later is stored.

The communication source continuity evaluation module 116 is connected to the transmission / reception module 102, the sensor information storage module 104, the communication plan storage module 114, and the evaluation value storage module 118. The communication source continuity evaluation module 116 uses the communication plan set in the communication device 150 and identification information that can specify the communication source of the communication device 150 to confirm that communication is continuously performed from the communication device 150. The continuity evaluation value shown is determined.
Here, the “information that can specify the communication source of the communication device 150” includes, for example, identification information of the communication device 150, SrcIP, SrcPort, TTL, and the like. SrcIP (Source IP address) is a source address recorded in header information such as a packet. The SrcPort is the source port number of the communication device 150. The TTL (Time To Live) can set the lifetime (effective lifetime) of a packet. For example, there is a method of specifying the lifetime by the number of passing routers, and a method of determining the lifetime by the number of seconds.

If the communication source continuity evaluation module 116 does not follow the communication plan set in the communication device 150, the continuity evaluation value may be set to the initial value. The “initial value” is, for example, “0”.
In addition, the communication source continuity evaluation module 116 follows the communication plan set for the communication device 150, and when the specific information is the same as the previous time and the current time, the continuity evaluation value of the current You may make it the value increased more than the evaluation value. Specifically, when communication is being performed from the same communication device 150 according to the communication plan, the continuity evaluation value increases.
Using the plurality of specific information, the communication source continuity evaluation module 116 determines the current continuity evaluation value in the communication device 150 for the specific information for each of the specific information when the specific information is the same as the previous continuity evaluation. You may make it the value increased more than the value.
Here, for example, “1” is added as “to increase the value”. Therefore, in this case, if two pieces of specific information (for example, SrcIP and TTL) are the same, “2” is added. Specifically, if the SrcIP is the same, it is increased by 1, furthermore, if it is the same SrcPort, it is increased by 1, and if it is the same TTL, it is increased by 1. Therefore, when all of SrcIP, SrcPort, and TTL are the same, the continuity evaluation value increases by 3.

  The evaluation value storage module 118 is connected to the communication source continuity evaluation module 116 and the unauthorized communication device determination module 120. The evaluation value storage module 118 stores the continuity evaluation value of each communication device 150 determined by the communication source continuity evaluation module 116. For example, a communication log information table 800 described later is stored.

The unauthorized communication device determination module 120 is connected to the transmission / reception module 102, the sensor information storage module 104, the evaluation value storage module 118, and the access control module 122. The unauthorized communication device determination module 120 determines whether the continuity evaluation value (the continuity evaluation value stored in the evaluation value storage module 118) determined by the communication source continuity evaluation module 116 satisfies a predetermined rule. Whether or not the target communication device 150 is a legitimate communication device is determined based on whether the communication device 150 is a legitimate communication device.
Further, the unauthorized communication device determination module 120 may determine that the communication device 150 is a legitimate communication device when the communication plan set in the communication device 150 is followed.
Further, if the current continuity evaluation value is in a predetermined order within the continuity evaluation value from the previous reception in the communication plan, the unauthorized communication device determination module 120 transmits the communication device 150 to a normal communication device. The device may be determined to be a device.
Here, “within the continuity evaluation value from the previous reception” indicates, for example, a continuity evaluation value in communication received within 10 minutes when the communication plan is to communicate every 10 minutes. I have. When the communication plan is followed and there is no unauthorized communication device, two comparison targets are the previous continuity evaluation value and the current continuity evaluation value. The case where the communication plan is not followed, for example, corresponds to the case where the communication device is initialized.
As the “predetermined order”, for example, there is a first place. The first place corresponds to the case where the current continuity evaluation value is the highest value.

  The access control module 122 is connected to the unauthorized communication device determination module 120. The access control module 122 performs control according to the determination result by the unauthorized communication device determination module 120. For example, the access control module 122 controls communication with the communication device 150 (communicates as it is, interrupts communication, etc.), and controls handling of data received from the communication device 150 (handles regular data). , Unauthorized data is deleted, and the administrator is notified that there is an unauthorized communication device 150.

The communication device 150 includes a transmission / reception module 152, a communication plan acquisition module 154, a communication plan storage module 156, and a communication plan execution module 158. The communication device 150 corresponds to, for example, an IoT device such as a sensor or an actuator. Preferably, the communication device 150 is a fixed IoT device, and is not installed in the mobile object or the mobile object.
The transmission / reception module 152 is connected to the communication plan acquisition module 154 and the communication plan execution module 158, and is connected to the transmission / reception module 102 of the information processing apparatus 100 via the communication line 190. The transmission / reception module 152 performs communication with the information processing device 100. For example, information (specific information that can identify a communication source, in addition to sensor information and the like) is transmitted to the information processing apparatus 100, and a communication plan is received from the communication device 150.

The communication plan acquisition module 154 is connected to the transmission / reception module 152 and the communication plan storage module 156. The communication plan acquisition module 154 acquires a communication plan from the information processing device 100 via the transmission / reception module 152, and stores the communication plan in the communication plan storage module 156.
The communication plan storage module 156 is connected to the communication plan acquisition module 154 and the communication plan execution module 158. The communication plan storage module 156 stores the communication plan acquired by the communication plan acquisition module 154. For example, a communication plan table 400 described later is stored.
The communication plan execution module 158 is connected to the transmission / reception module 152 and the communication plan storage module 156. The communication plan execution module 158 transmits information (such as sensor information) to the information processing apparatus 100 via the transmission / reception module 152 according to the communication plan in the communication plan storage module 156.

FIG. 2 is an explanatory diagram showing a system configuration example using the present embodiment.
The information processing apparatus 100 is communicably connected to a plurality of communication devices 150 (for example, a communication device 150a, a communication device 150b, a communication device 150c, a communication device 150d, and the like) via a communication line 190. Further, the function of the information processing apparatus 100 may be realized as a cloud service. The information processing device 100 receives data from each communication device 150, stores the data, and performs various processes using the data. Further, the information processing apparatus 100 determines whether or not the communication device 150 is a legitimate communication device 150, performs an original process on data from the legitimate communication device 150, and performs The above-mentioned control (communication disconnection, data deletion, etc.) is performed.

  FIG. 3 is a flowchart illustrating a processing example according to the present embodiment. 5 shows an example of processing by the communication device 150. For example, a description will be given of a flow of an example in which the communication device 150 equipped with the sensor stores the sensor information in the information processing apparatus 100 including the audit module 110 according to the present embodiment.

In step S302, the communication plan execution module 158 determines whether or not there is a valid communication plan in the communication plan storage module 156. If so, the process proceeds to step S306; otherwise, the process proceeds to step S304. For example, the communication plan has an expiration date, and if the current time is within the expiration date, it may be determined that the communication plan is a valid communication plan.
In step S304, the communication plan acquisition module 154 acquires a communication plan from the information processing device 100 and stores the communication plan in the communication plan storage module 156.
For example, when there is no valid communication plan in the communication plan storage module 156 as the processing of step S302 and step S304, initial authentication is performed with the information processing apparatus 100, and the communication plan for the identifier (for example, 0001) of the own communication device 150 is performed. Is acquired from the information processing apparatus 100 and stored in the communication plan storage module 156.
In the present embodiment, since the initial authentication with the communication device 150 is important for obtaining a trust anchor, the initial authentication may be combined with a strong authentication mechanism.

In step S306, the communication plan execution module 158 communicates with the information processing device 100 according to the communication plan, and returns to step S302. For example, referring to the communication plan storage module 156, the sensor information is transmitted to the information processing apparatus 100 according to the communication plan.
As the communication plan, for example, there is a communication plan table 400. FIG. 4 is an explanatory diagram showing an example of the data structure of the communication plan table 400. The communication plan table 400 has a communication device ID column 402 and a communication interval column 404. The communication device ID column 402 stores information (communication device ID: IDentification) for uniquely identifying the communication device 150 in the present embodiment. The communication interval column 404 stores the communication interval of the communication device 150. In the communication plan shown in the example of FIG. 4, the communication device ID: 0001 performs communication at intervals of 10 minutes.

Specifically, the operation is as follows.
1. According to the communication plan, a timer is executed and sleep is performed for 10 minutes.
2. The socket is opened, and communication is performed according to the interface specification with the information processing apparatus 100 defined in advance. At this time, the communication device ID of the communication device 150 is included in the packet (may be a header or a payload).
Repeat the above.

  FIG. 5 is a flowchart illustrating a processing example according to the present embodiment. 2 shows an example of processing by the information processing apparatus 100.

In step S502, the communication plan presentation module 112 determines whether or not the initial authentication of the communication device 150 is performed. If the initial authentication is performed, the process proceeds to step S504; otherwise, the process proceeds to step S506.
In step S504, the communication plan is transmitted, and the process ends (step S599). Specifically, when the communication from the communication device 150 is the initial authentication, the communication plan for the communication device ID of the communication device 150 stored in the communication plan storage module 114 is transmitted to the communication device 150 in advance. For example, the communication plan table 600 is used. FIG. 6 is an explanatory diagram showing an example of the data structure of the communication plan table 600. The communication plan table 600 has a communication device ID column 602 and a communication interval column 604. The communication device ID column 602 stores a communication device ID. The communication interval column 604 stores a communication interval of the communication device 150. In the communication plan shown in the example of FIG. 6, the communication device ID: 0001 performs communication at intervals of 10 minutes. The communication device ID: 0002 performs communication at intervals of 10 minutes. Further, the communication plan may be provided with an expiration date, and the communication plan may be dynamically updated (when the expiration date has passed, a new communication plan may be set).

In step S506, the communication source continuity is evaluated. For example, SrcIP, TTL, communication device ID and reception time are extracted from the received packet as communication source information, and the extracted communication time is compared with a communication plan corresponding to the communication device ID to evaluate communication continuity (continuity evaluation value). To determine). The detailed process in step S506 will be described later with reference to the flowcharts shown in FIGS. 7 and 11. In step S508, it is determined whether the communication device 150 is an unauthorized communication device. That is, based on the continuity evaluation value calculated in step S506, it is determined whether the communication device 150 is an unauthorized communication device. Detailed processing in step S508 will be described later using a flowchart shown in the example of FIG.

In step S510, it is determined whether or not the device is an unauthorized communication device 150. If the device is an unauthorized communication device 150, the process proceeds to step S514; otherwise, the process proceeds to step S512.
In step S512, the sensor information is stored.
In step S514, access is controlled.
If the communication device 150 is determined to be an unauthorized communication device 150 (step S510: Yes), access control is performed (step S514). For example, SrcIP restriction is performed. Otherwise (step S510: No), the communication is permitted and the sensor information is stored (step S512).

  FIG. 7 is a flowchart illustrating a processing example according to the present embodiment. FIG. 6 shows a detailed processing example in step S506 in the flowchart shown in the example of FIG.

In step S702, it is determined whether or not the communication having the same communication device ID has occurred before the communication interval of the communication plan. If yes, the process proceeds to step S706; otherwise, the process proceeds to step S704. “Before the communication interval of the communication plan” is, for example, 10 minutes before in the communication device ID: 0001 of the communication plan table 600 shown in FIG.
In step S704, the continuity evaluation value is initialized (for example, the continuity evaluation value is set to 0), and the process ends (step S799). Since the communication is interrupted for some reason, the continuity evaluation value becomes zero.

In step S706, the continuity evaluation value before the communication interval in the communication plan is loaded. For example, referring to FIG. 8, if the current time is 10:10, “0” is extracted from the continuity evaluation value column 810 in the first line of the communication log information table 800 in the evaluation value storage module 118. become.
In step S708, it is determined whether or not the SrcIPs are the same. If they are the same, the process proceeds to step S710; otherwise, the process proceeds to step S712.
In step S710, 1 is added to the continuity evaluation value.
In step S712, it is determined whether or not the TTLs are the same. If the TTLs are the same, the process proceeds to step S714; otherwise, the process ends (step S799).
In step S714, 1 is added to the continuity evaluation value. In the example using FIG. 8 described above, 1 is added twice to the continuity evaluation value: 0 in steps S710 and S714, so the continuity evaluation value is 2.

An example of a processing result (calculation result of continuity evaluation value) according to the flowchart illustrated in the example of FIG. 7 will be described with reference to FIGS. 8 to 10.
FIG. 8 is an explanatory diagram showing an example of the data structure of the communication log information table 800. For example, the communication log information table 800 indicates a communication log in a case where the impersonation communication by the unauthorized communication device 150 occurs.
The communication log information table 800 has a communication device ID column 802, a reception time column 804, a SrcIP column 806, a TTL column 808, and a continuity evaluation value column 810. The communication device ID column 802 stores a communication device ID. The reception time column 804 stores the date and time (year, month, day, hour, minute, second, seconds or less, or a combination thereof) received from the communication device 150. The SrcIP column 806 stores SrcIP in the communication. The TTL column 808 stores the TTL for the communication. The continuity evaluation value column 810 stores the continuity evaluation value of communication by the communication device 150.
The fourth row (reception time is 10:22) and the sixth row (data at 10:32 of the reception time) of the communication log information table 800 are data to be determined to be invalid. Is 0, and the continuity evaluation value on the sixth row is 2. The continuity evaluation values on the other rows are increased by 2 in order from the top.

FIG. 9 is an explanatory diagram showing an example of the data structure of the communication log information table 900. For example, the communication log information table 900 indicates a communication log due to recovery from a planned stop in the legitimate communication device 150. The data structure of the communication log information table 900 is the same as the communication log information table 800 shown in the example of FIG.
Note that it is not desired that any of the information in the communication log information table 900 is determined to be invalid. This example shows a case where the planned suspension (for example, the shutdown of the communication device 150) occurs after 10:20 and the restoration is performed before 12:00, and the continuity evaluation value in the fourth row is It becomes 0 and then increases by two.

FIG. 10 is an explanatory diagram showing an example of the data structure of the communication log information table 1000.
For example, the communication log information table 1000 indicates a communication log due to a move (within 10 minutes) after the scheduled stoppage of the legitimate communication device 150. The data structure of the communication log information table 1000 is the same as the communication log information table 800 shown in the example of FIG.
Note that it is not desired that any of the information in the communication log information table 1000 be determined to be invalid. In this example, at about 10:25, the communication device 150 at a certain base is moved to another base, and both SrcIP and TTL are changed. The continuity evaluation value in the fourth row is 0, and thereafter, it is increased by two.

  FIG. 11 is a flowchart illustrating a processing example according to the present embodiment. FIG. 9 illustrates a detailed processing example in step S <b> 506 in the flowchart illustrated in the example of FIG. 5, and is a processing example other than the processing example in the flowchart illustrated in the example of FIG. 7.

The flowchart illustrated in the example of FIG. 11 is obtained by adding steps S1116 and S1118 to the flowchart illustrated in the example of FIG.
In step S1102, it is determined whether or not communication with the same communication device ID has occurred before the communication interval of the communication plan. If yes, the process proceeds to step S1106; otherwise, the process proceeds to step S1104.
In step S1104, the continuity evaluation value is initialized (for example, the continuity evaluation value is set to 0), and the process ends (step S1199). Since the communication is interrupted for some reason, the continuity evaluation value becomes zero.
In step S1106, the continuity evaluation value before the communication interval in the communication plan is loaded.
In step S1108, it is determined whether or not the SrcIPs are the same. If the SrcIPs are the same, the process proceeds to step S1110; otherwise, the process proceeds to step S1112.
In step S1110, 1 is added to the continuity evaluation value.
In step S1112, it is determined whether or not the TTLs are the same. If the TTLs are the same, the process proceeds to step S1114; otherwise, the process proceeds to step S1116.
In step S1114, 1 is added to the continuity evaluation value.
In step S1116, it is determined whether or not the SrcPorts are the same. If they are the same, the process proceeds to step S1118, otherwise, the process ends (step S1199).
In step S1118, 1 is added to the continuity evaluation value.
Steps S1116 and S1118 are added to the flowchart shown in the example of FIG. 7, and SrcPort is also an element for adding the continuity evaluation value.

  FIG. 12 is a flowchart illustrating a processing example according to the present embodiment. FIG. 6 shows a detailed processing example in step S508 in the flowchart shown in the example of FIG.

In step S1202, it is determined whether or not the same communication with the communication device ID has occurred within (may be less than) the communication interval of the communication plan. If yes, the process proceeds to step S1206; otherwise, the process proceeds to step S1204.
In step S1204, it is determined that the communication device 150 is the legitimate communication device 150, and the process ends (step S1299). Depending on the policy (when a strict judgment standard is used), the judgment may be suspended.

In step S1206, all continuity evaluation values within (or less than) the communication interval of the communication plan are loaded. For example, with reference to FIG. 8, if the target is the fifth line (10:30), the third and fourth lines of the communication log information table 800 in the communication log information table 800 within 10 minutes of the communication interval. The sex evaluation values ("4" and "0", respectively) are extracted.
In step S1208, it is determined whether the current communication is the highest among the loaded continuity evaluation values. If it is the highest, the process proceeds to step S1210; otherwise, the process proceeds to step S1212. In the example described above, the continuity evaluation value (“6”) in the fifth row is the highest value (others are “4” and “0”), so the process proceeds to step S1210.
In step S1210, it is determined that the communication device 150 is the legitimate communication device 150, and the process ends (step S1299).

In step S1212, it is determined whether or not the continuity evaluation value of the current communication is 0. If it is 0, the process proceeds to step S1214; otherwise, the process proceeds to step S1216.
In step S1214, it is determined that the determination is suspended, and the process ends (step S1299).
In step S1216, it is determined that the communication device 150 is unauthorized.

13 to 15, the communication log information table 800, the communication log information table 900, and the communication log information table 1000 shown in the examples of FIGS. 8 to 10 are processed according to the flowchart shown in the example of FIG. An example of a result (result of determining whether or not the communication device 150 is a legitimate communication device) will be described.
FIG. 13 is an explanatory diagram showing an example of the data structure of the communication log information table 1300.
The communication log information table 1300 is obtained by adding a judgment result column 1312 to the communication log information table 800 shown in the example of FIG.
The communication log information table 1300 has a communication device ID column 1302, a reception time column 1304, a SrcIP column 1306, a TTL column 1308, a continuity evaluation value column 1310, and a judgment result column 1312. The communication device ID column 1302 stores a communication device ID. The reception time column 1304 stores the reception time. The SrcIP column 1306 stores SrcIP. The TTL column 1308 stores the TTL. The continuity evaluation value column 1310 stores a continuity evaluation value. The judgment result column 1312 stores the judgment result.
The fourth row of the communication log information table 1300 is “determined pending” in step S1214, and the sixth row is determined to be “illegal” in step S1216.

FIG. 14 is an explanatory diagram showing an example of the data structure of the communication log information table 1400.
The communication log information table 1400 is obtained by adding a judgment result column 1412 to the communication log information table 900 shown in the example of FIG.
In the fourth row of the communication log information table 1400, since there is no communication log within 10 minutes, it is determined to be "regular" in step S1204, and is determined to be "regular" thereafter.

FIG. 15 is an explanatory diagram showing an example of the data structure of the communication log information table 1500.
The communication log information table 1500 is obtained by adding a judgment result column 1512 to the communication log information table 1000 shown in the example of FIG.
The fourth row of the communication log information table 1500 is determined to be “determination pending” in step S1214.

FIG. 16 is an explanatory diagram showing an example of transition of the continuity evaluation value according to the present embodiment.
It is an example of a graph in which a vertical axis indicates a continuity evaluation value and a horizontal axis indicates a time axis. A case where communication from two communication devices 150 having the same communication device ID is present to the information processing apparatus 100 is shown. The regular communication device 150 starts communication at 10:00 and performs communication every 10 minutes according to the communication plan. Therefore, the continuity evaluation value is incremented by 2 every 10 minutes. On the other hand, since the unauthorized communication device 150 has been communicating since 10:22 and has been communicating every 10 minutes according to the same communication plan, the continuity evaluation value is incremented by 2 every 10 minutes. I have. Here, in a period 1630 in which the continuity evaluation value line 1610 of the legitimate communication device and the continuity evaluation value line 1620 of the unauthorized communication device are multiplexed, the information processing apparatus 100 displays the line indicating the highest value (the line of the legitimate communication device). Communication other than the continuity evaluation value line 1610) is detected as communication from an unauthorized communication device.

FIG. 17 is an explanatory diagram showing another example of the system configuration using the present embodiment.
In the example illustrated in FIG. 17A, the information processing apparatus 100 is communicably connected to a communication device 150, a server A: 1710A, and a server B: 1710B. The server A: 1710A and the server B: 1710B are servers that do not have the audit module 110. The information processing apparatus 100 determines the server A: 1710A and the server B: 1710B by the audit module 110 (for example, the communication log information table 1300, the communication log information table 1400, and the communication log information illustrated in FIGS. 13 to 15). When the server A: 1710A and the server B: 1710B perform communication with the communication device 150 by notifying (propagating) the information table 1500), the determination result is used to determine whether or not the server is a legitimate communication device 150. The processing may be changed depending on the processing. For example, the server 1710 processes data from the legitimate communication device 150 and deletes data from the unauthorized communication device 150. For example, the same effect can be obtained with a large number of servers (server A: 1710A, server B: 1710B) even if only one server (information processing device 100) performs regular communication.
In the example shown in FIG. 17B, the information processing device 100, the communication device 150a, the communication device 150b, the communication device 150c, the communication device 150d, the server A: 1710A, and the server B: 1710B are connected via the communication line 190, respectively. Have been. That is, the server A: 1710A and the server B: 1710B may also receive data from the communication device 150a or the like.
Usually, in the IoT center system, a plurality of servers exist for each role. With the configuration shown in the example of FIG. 17, the entire system is not changed on the communication device 150 side, and it is not necessary to mount the audit module 110 on all the servers 1710 (at least one server 1710 has the audit module 110 It is necessary to mount the information processing device 100) to protect the communication device 150 from spoofing attacks.

  With reference to FIG. 18, an example of a hardware configuration of the information processing apparatus 100 and the server 1710 according to the present embodiment will be described. The configuration illustrated in FIG. 18 is configured by, for example, a personal computer (PC) or the like, and illustrates a hardware configuration example including a data reading unit 1817 such as a scanner and a data output unit 1818 such as a printer.

  The CPU (Central Processing Unit) 1801 includes various modules described in the above embodiment, that is, the transmission / reception module 102, the audit module 110, the communication plan presentation module 112, the communication source continuity evaluation module 116, the unauthorized communication device determination module. The control unit 120 executes a process according to a computer program describing an execution sequence of each module such as the access control module 122 and the like.

  A ROM (Read Only Memory) 1802 stores a program used by the CPU 1801, a calculation parameter, and the like. A RAM (Random Access Memory) 1803 stores programs used in the execution of the CPU 1801, parameters that change as appropriate in the execution, and the like. These are mutually connected by a host bus 1804 including a CPU bus and the like.

  The host bus 1804 is connected via a bridge 1805 to an external bus 1806 such as a PCI (Peripheral Component Interconnect / Interface) bus.

  A keyboard 1808 and a pointing device 1809 such as a mouse are devices operated by an operator. The display 1810 includes a liquid crystal display device or a CRT (Cathode Ray Tube), and displays various information as text or image information. Further, a touch screen or the like having both functions of the pointing device 1809 and the display 1810 may be used. In that case, for realization of the function of the keyboard, a keyboard (also called a so-called software keyboard, screen keyboard, or the like) is drawn by software on a screen (touch screen) without physically connecting the keyboard as in the case of the keyboard 1808. Alternatively, a function of a keyboard may be realized.

  An HDD (Hard Disk Drive) 1811 incorporates a hard disk (which may be a flash memory or the like), drives the hard disk, and records or reproduces a program executed by the CPU 1801 or information. The hard disk realizes functions as the sensor information storage module 104, the communication plan storage module 114, the evaluation value storage module 118, and the like. Further, various other data, various computer programs, and the like are stored.

  The drive 1812 reads data or a program recorded on a removable recording medium 1813 such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, and transfers the data or the program to the interface 1807 and the external bus 1806. , A bridge 1805, and a RAM 1803 connected via a host bus 1804. Note that the removable recording medium 1813 can also be used as a data recording area.

  The connection port 1814 is a port for connecting an externally connected device 1815, and has a connection unit such as USB and IEEE1394. The connection port 1814 is connected to the CPU 1801 and the like via the interface 1807, the external bus 1806, the bridge 1805, the host bus 1804, and the like. The communication unit 1816 (corresponding to the transmission / reception module 102) is connected to a communication line and executes data communication processing with the outside (corresponding to the communication device 150). The data reading unit 1817 is, for example, a scanner and executes a document reading process. The data output unit 1818 is, for example, a printer, and executes a document data output process.

  Note that the hardware configurations of the information processing apparatus 100 and the server 1710 illustrated in FIG. 18 illustrate one configuration example, and the present embodiment is not limited to the configuration illustrated in FIG. 18 and will be described in the present embodiment. Any configuration can be used as long as the module can be executed. For example, some modules may be constituted by dedicated hardware (for example, an application-specific integrated circuit (ASIC) or the like), and some modules may be in an external system and connected by a communication line. Alternatively, a plurality of the systems shown in FIG. 18 may be connected to each other by a communication line so as to cooperate with each other. In particular, in addition to personal computers, portable information communication devices (including mobile phones, smartphones, mobile devices, wearable computers, etc.), information appliances, robots, copiers, fax machines, scanners, printers, and multifunction devices (scanners, printers, An image processing apparatus having at least two functions such as a copying machine and a facsimile) may be incorporated.

The above-described program may be provided by being stored in a recording medium, or the program may be provided by a communication unit. In this case, for example, the above-described program may be regarded as an invention of a “computer-readable recording medium on which the program is recorded”.
The “computer-readable recording medium on which the program is recorded” refers to a computer-readable recording medium on which the program is recorded, which is used for installing, executing, and distributing the program.
The recording medium is, for example, a digital versatile disk (DVD), which is a standard defined by the DVD Forum, such as "DVD-R, DVD-RW, DVD-RAM, etc.", and DVD + RW. Blu-ray discs such as "DVD + R, DVD + RW, etc." which are standards, compact discs (CDs) such as read-only memory (CD-ROM), CD recordable (CD-R), CD rewritable (CD-RW), etc. Blu-ray (registered trademark) Disc), magneto-optical disk (MO), flexible disk (FD), magnetic tape, hard disk, read-only memory (ROM), electrically erasable and rewritable read-only memory (EEPROM (registered trademark) )), Flash memory, random access memory (RAM) , SD (Secure Digital) memory card, and the like.
The whole or a part of the program may be recorded on the recording medium and stored or distributed. In addition, the communication may be, for example, a wired network used for a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), the Internet, an intranet, an extranet, or a wireless communication. The data may be transmitted using a transmission medium such as a network or a combination thereof, or may be transmitted on a carrier wave.
Further, the above program may be a part or all of another program, or may be recorded on a recording medium together with a separate program. Further, the program may be divided and recorded on a plurality of recording media. Further, the program may be recorded in any form as long as it can be restored, such as compression or encryption.

REFERENCE SIGNS LIST 100 information processing device 102 transmission / reception module 104 sensor information storage module 110 audit module 112 communication plan presentation module 114 communication plan storage module 116 communication continuity evaluation module 118 evaluation value storage module 120 unauthorized communication device Determination module 122 access control module 150 communication device 152 transmission / reception module 154 communication plan acquisition module 156 communication plan storage module 158 communication plan execution module 190 communication line

Claims (7)

Receiving means for receiving information from the communication device;
Using a communication plan set for the communication device and identification information that can identify a communication source of the communication device, determining a continuity evaluation value indicating that communication is continuously performed from the communication device. Means,
An information processing apparatus comprising: a determination unit configured to determine whether the communication device is a legitimate communication device based on whether the continuity evaluation value satisfies a predetermined rule. The determining means, when not following the communication plan set in the communication device, the continuity evaluation value to the initial value,
The information processing device according to claim 1. The determining means follows the communication plan set for the communication device, and when the specific information is the same as the previous and current times, increases the current continuity evaluation value of the communication device from the previous continuity evaluation value. Value
The information processing device according to claim 1. Using multiple specific information,
In the case where the specific information is the same in the previous time and the present time, for each of the specific information, the current continuity evaluation value in the communication device is set to a value increased from the previous continuity evaluation value,
The information processing device according to claim 3. The determining means determines that the communication device is a legitimate communication device when the communication device is in accordance with a communication plan set for the communication device.
The information processing device according to claim 1. The determining means, in the continuity evaluation value from the previous reception in the communication plan, if the current continuity evaluation value is in a predetermined order, the communication device is a legitimate communication device to decide,
The information processing device according to claim 5. Computer
Receiving means for receiving information from the communication device;
Using a communication plan set for the communication device and identification information that can identify a communication source of the communication device, determining a continuity evaluation value indicating that communication is continuously performed from the communication device. Means,
An information processing program for functioning as a judging means for judging whether or not the communication device is a legitimate communication device based on whether or not the continuity evaluation value satisfies a predetermined rule.

Images